Methods and apparatus to apply multiple trip limits to a device in a process control system

ABSTRACT

Methods and apparatus to apply multiple trip limits to a device in a process control system are disclosed. An example method involves monitoring a value of a parameter associated with the operation of the device and receiving an input indicative of an operational state of the device, where a first input indicates a first operational state and a second input indicates a second operational state. If the first input is received, comparing via a function block the value of the parameter to a first trip limit, and if the second input is received, comparing via the function block the value of the parameter to a second trip limit, and implementing a response based on the comparison.

SYSTEM FIELD OF THE DISCLOSURE

This disclosure relates generally to process control systems and, moreparticularly, to methods and apparatus to apply multiple trip limits toa device in a process control system.

BACKGROUND

Process control systems, like those used in chemical, petroleum or otherprocesses, typically include one or more process controllerscommunicatively coupled to one or more field devices via analog, digitalor combined analog/digital buses. The field devices, which may be, forexample, valves, valve positioners, switches and transmitters (e.g.,temperature, pressure and flow rate sensors), perform process controlfunctions within the process such as opening or closing valves andmeasuring process control parameters. The process controllers receivesignals indicative of process measurements made by the field devices andthen process this information to generate control signals to implementcontrol routines, and to otherwise manage the operation of the processcontrol system.

Many industries now implement process control systems with the use ofdigital control and communications between field devices, controllers,and other elements of a process control system. With the rise of digitalcontrol and communications, a number of standard digital as well ascombined analog and digital open communication protocols have beendeveloped to facilitate the communications between field devices andcontrollers. Some of the protocols utilize a basic building block orsoftware construct commonly referred to as a function block.

In general, function blocks are programs that, when executed, performone or more algorithms or sequences of operation relevant to a processcontrol system for which a process engineer has configured the functionblocks. There are many types of function blocks, each of which generallyperforms a specific portion of a process control routine. Typically,function blocks implement input, control, output, as well as otherfunctions within a process control system and can be downloaded andinstantiated within controllers and/or field devices distributedthroughout a process control system.

For example, an analog input (AI) function block may be instantiatedwithin a sensor or transmitter configured to measure a parameter (e.g.,temperature, strain, flow, etc.), and an analog voter (AVTR) functionblock may be instantiated within a controller, which may be incommunication with the sensor or transmitter performing the AI functionblock to compare the analog input to a configured trip limit todetermine whether an appropriate response should be tripped andimplemented based on the comparison. An AVTR function block is called a“voter” block because it can receive multiple inputs that may becompared with the configured trip limit, where each comparisonconstitutes one vote. If an input exceeds the configured trip limit, theAVTR function block counts that event as a vote to set the output toTripped. If the required number of inputs “vote” to trip, the output ofthe AVTR function block goes to a tripped value.

Many other types of function blocks can be instantiated within fielddevices and controllers and interlinked via communication media in asimilar manner to perform almost any desired function of a processcontrol scheme.

SUMMARY

In one example, a method to apply multiple trip limits to a device in aprocess control system involves monitoring a value of a parameterassociated with the operation of the device and receiving an inputindicative of an operational state of the device, where a first inputindicates a first operational state and a second input indicates asecond operational state. If the first input is received, comparing viaa function block the value of the parameter to a first trip limit, andif the second input is received, comparing via the function block thevalue of the parameter to a second trip limit, and implementing aresponse based on the comparison.

In another example, a processor, when operated, implements a functionblock to receive an input indicative of an operational state of aprocess control system device and first and second trip limits for aparameter associated with the operation of the device, wherein the firstand second trip limits are associated with respective first and secondoperational states of the device. The processor further implements thefunction block to determine when the device is in a first operationalcondition by enabling the first trip limit when the input indicates thedevice is in the first operational state, enabling the second trip limitwhen the input indicates the device is in the second operational state;and determining when the parameter passes the enabled trip limit; and toimplement a response when the device is in the first operationalcondition.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic illustration of an example process control system.

FIG. 2 illustrates an example manner of implementing the exampleoperator station of FIG. 1.

FIG. 3 illustrates a known schematic layout of a known control module offunction blocks of FIG. 2 configured to apply multiple trip limits to asingle parameter of a process control system device.

FIG. 4 illustrates a known function block configuration interface toconfigure the logic of the known CALC function block shown in FIG. 3.

FIG. 5 illustrates an example schematic layout of a control module offunction blocks of FIG. 2 configured to apply multiple trip limits to asingle parameter of a process control system device via the exampleoperator station of FIG. 1 and/or FIG. 2.

FIG. 6 illustrates an example function block configuration interface toconfigure the parameters of the AVTR function block shown in FIG. 5.

FIG. 7 is a flowchart representative of an example process that may becarried out to implement the example operator station of FIG. 1 and/orFIG. 2.

FIG. 8 is a schematic illustration of an example computer that may beused and/or programmed to carry out the example process of FIG. 7and/or, more generally, to implement the example operator station ofFIG. 1 and/or FIG. 2.

DETAILED DESCRIPTION

Under many process control system schemes it is desirable to havemultiple trip limits applied to a single device. For example, someparameters within a control system (e.g., temperature, pressure, etc.)may need to be within a certain range having upper and lower bounds and,therefore, require a low limit and a high limit. In other circumstances,a parameter within a control system may only be bounded on one side.However, process engineers may set a multi-level hierarchy of limitsthat implement different responses as each successive limit is passed.For example, a parameter may have a first high limit that provides awarning if exceeded and a second high limit higher than the first(commonly referred to as a high-high limit) that provides a criticalwarning and/or trips the device into a safe state (e.g., shut down).

In yet other circumstances, process engineers may set different limitsfor a device in a process control system environment based upon theoperational state of the device. For example, in a typical machineryprotection system, a vibration trip limit defining an unsafe level ofvibration may be configured to trip a machine to a safe state (e.g.,off) when the limit is exceeded during a normal running state of themachine (hereinafter referred to as a normal operational state).However, during other operational states (e.g., startup, slow roll,maintenance, etc.) the vibration of the machine may exceed the normalrunning vibrational trip limit and trip the machine to shut down eventhough the operational condition (i.e., high vibrations) is expected dueto the operational state of the machine being in a state other than thenormal operational state. Therefore, it may be desirable to have adifferent trip limit that applies to certain known states other than thenormal operational state. Such operational states other than the normaloperational state are herein referred to as abnormal operational states.

Typically, to implement multiple trip limits for a device in a processcontrol system, after configuring a first trip limit associated with afirst operational state (i.e., a normal operational state) of a device,a process engineer may configure a trip multiply factor that is enabledduring abnormal operational state(s) to effectively raise the trip limitby multiplying the first trip limit by the multiply factor. The productof these two values becomes a second trip limit to be applied during theabnormal operational state(s). Designating when the trip multiply factorshould be enabled is typically accomplished by wiring a key switch, pushbutton, etc., to the control system. When an operator engages the keyswitch, a signal is sent to the control system to enable the multiplyfactor and to apply the resulting second trip limit. However, there areseveral problems and/or limitations with this traditional approach.

First, there is no way for the control system to detect whether the keyswitch has malfunctioned and may be improperly engaged in the enabledposition. As a result, the second trip limit may be used while a deviceis in a normal operational state when the first trip limit should apply.This may give rise to potentially unsafe and/or otherwise undesirableoperational conditions without the intended trip response beingimplemented when a parameter passes the first trip limit.

Second, there is no time limit associated with the trip multiply factorto disable the second trip limit corresponding to the abnormaloperational state. For example, in many instances, the typical durationof an abnormal operational state may be known (e.g., the time for amachine to start up) such that continuing in the abnormal operationalstate beyond that time may suggest an unsafe and/or otherwiseundesirable operational condition. Thus, without a time limit, it is upto operators to track how long the second trip limit is to apply givingrise to potential errors and/or taking the attention of operators awayfrom other tasks related to the operation of the process control system.This problem is exacerbated by the fact that in typical implementationsof multiple trip limits, operators must engage the key switch or otherindicator of the abnormal operational state for the entire duration thatthe device is to be monitored relative to the second trip limit.Accordingly, not only must operators keep track of the duration of theabnormal operational state but they must hold the key switch during thatperiod further limiting them from attending to other aspects of theprocess control system.

Third, under the traditional approach of applying multiple trip limitsto a device described above, the trip limits are not independent of oneanother. Rather, the second trip limit (associated with abnormaloperational states) is based on the first trip limit via a multiplyfactor. As such, if an engineer desires to alter the first trip limitbut keep the second trip limit the same, the engineer may need toperform a back calculation to determine how the multiply factor needs tobe adjusted so that the product of the multiply factor and the alteredfirst trip limit still amounts to the desired second trip limit.However, if the engineer adjusts the first trip limit but fails torecalculate the multiply factor based on the change in the first triplimit, then the second trip limit may be at an incorrect value eithercausing the device to trip too soon or two late depending on thedirection the first trip limit was adjusted.

Finally, there may be configuration errors made when changing the triplimit that do not return the trip limit to the first trip limit(associated with a normal operational state) when the trip multiplyfactor is disengaged. Determining when the multiply factor applies(i.e., when a device is in an abnormal operational state), as well asactually multiplying the first trip limit and the multiply factor in thetypical approach, is accomplished through a calculation (CALC) functionblock. A CALC function block enables a process engineer to write customcode that uses the inputs to determine the proper output. If the logicexpressions written by an operator and/or engineer are incorrect, theproper trip limit applied to the control system may also be incorrect orthe configured function block may otherwise work improperly. The actualdigital control configuration using function blocks for this knownapproach and its attending limitations are discussed in further detailbelow in connection with FIGS. 3 and 4.

FIG. 1 is a schematic illustration of an example process control system100. The example process control system 100 of FIG. 1 includes one ormore process controllers (one of which is designated at referencenumeral 102), one or more operator stations (one of which is designatedat reference numeral 104), and one or more workstations (one of whichare designated at reference numeral 106). The example process controller102, the example operator station 104, and the example workstation 106are communicatively coupled via a bus and/or local area network (LAN)108, which is commonly referred to as an application control network(ACN).

The example operator station 104 of FIG. 1 allows an operator and/orengineer to review and/or operate one or more operator display screensand/or applications that enable the operator and/or engineer to viewprocess control system variables, view process control system states,view process control system conditions, view process control systemalarms, and/or change process control system settings (e.g., set points,operating states, clear alarms, silence alarms, etc.). An example mannerof implementing the example operator station 104 of FIG. 1 is describedbelow in connection with FIG. 2. Example function blocks and relatedinterfaces that may be used to implement the example operator station104 are described below in connection with FIGS. 5 and 6.

The example operator station 104 includes and/or implements a digitalcontrol application to allow process control system operators and/orengineers to configure functions blocks within control modules (e.g.,the control module of FIG. 5). The example workstation 106 of FIG. 1 maybe configured as an application station to perform one or moreinformation technology applications, user-interactive applicationsand/or communication applications. For example, the application station106 may be configured to perform primarily process control-relatedapplications, while another application station (not shown) may beconfigured to perform primarily communication applications that enablethe process control system 100 to communicate with other devices orsystems using any desired communication media (e.g., wireless,hardwired, etc.) and protocols (e.g., HTTP, SOAP, etc.). The exampleoperator station 104 and the example workstation 106 of FIG. 1 may beimplemented using one or more workstations and/or any other suitablecomputer systems and/or processing systems. For example, the operatorstation 104 and/or workstation 106 could be implemented using singleprocessor personal computers, single or multi-processor workstations,etc.

The example LAN 108 of FIG. 1 may be implemented using any desiredcommunication medium and protocol. For example, the example LAN 108 maybe based on a hardwired and/or wireless Ethernet communication scheme.However, as will be readily appreciated by those having ordinary skillin the art, any other suitable communication medium(s) and/orprotocol(s) could be used. Further, although a single LAN 108 isillustrated in FIG. 1, more than one LAN and/or other alternative piecesof communication hardware may be used to provide redundant communicationpaths between the example systems of FIG. 1.

The example controller 102 of FIG. 1 is coupled to a plurality of smartfield devices 110, 112 and 114 via a digital data bus 116 and aninput/output (I/O) gateway 118. The smart field devices 110, 112, and114 may be Fieldbus compliant valves, actuators, sensors, etc., in whichcase the smart field devices 110, 112, and 114 communicate via thedigital data bus 116 using the well-known Foundation Fieldbus protocol.Of course, other types of smart field devices and communicationprotocols could be used instead. For example, the smart field devices110, 112, and 114 could instead be Profibus and/or HART compliantdevices that communicate via the data bus 116 using the well-knownProfibus and HART communication protocols. Additional I/O devices(similar and/or identical to the I/O gateway 118) may be coupled to thecontroller 102 to enable additional groups of smart field devices, whichmay be Foundation Fieldbus devices, HART devices, etc., to communicatewith the controller 102.

In addition to the example smart field devices 110, 112, and 114, one ormore non-smart field devices 120 and 122 may be communicatively coupledto the example controller 102. The example non-smart field devices 120and 122 of FIG. 1 may be, for example, conventional 2-20 milliamp (mA)or 0-10 volts direct current (VDC) devices that communicate with thecontroller 102 via respective hardwired links.

The example controller 102 of FIG. 1 may be, for example, a DeltaV™controller sold by Fisher-Rosemount Systems, Inc., an Emerson ProcessManagement company. However, any other controller could be used instead.Further, while only one controller 102 is shown in FIG. 1, additionalcontrollers and/or process control platforms of any desired type and/orcombination of types could be coupled to the LAN 108. In any case, theexample controller 102 performs one or more process control routinesassociated with the process control system 100 that have been generatedby a system engineer and/or other system operator using the operatorstation 104 and which have been downloaded to and/or instantiated in thecontroller 102.

While FIG. 1 illustrates an example process control system 100 withinwhich the methods and apparatus to control information presented toprocess control system operators described in greater detail below maybe advantageously employed, persons of ordinary skill in the art willreadily appreciate that the methods and apparatus to control informationpresented to operators described herein may, if desired, beadvantageously employed in other process plants and/or process controlsystems of greater or less complexity (e.g., having more than onecontroller, across more than one geographic location, etc.) than theillustrated example of FIG. 1.

FIG. 2 illustrates an example manner of implementing the exampleoperator station 104 of FIG. 1. The example operator station 104 of FIG.2 includes at least one programmable processor 200. The exampleprocessor 200 of FIG. 2 executes coded instructions present in a mainmemory 202 of the processor 200 (e.g., within a random-access memory(RAM) and/or a read-only memory (ROM)). The processor 200 may be anytype of processing unit, such as a processor core, a processor and/or amicrocontroller. The processor 200 may execute, among other things, anoperating system 204, a digital control application 206, process controlmodule(s) 208, and function block(s) 210. An example operating system204 is an operating system from Microsoft®. The example main memory 202of FIG. 2 may be implemented by and/or within the processor 200 and/ormay be one or more memories and/or memory devices operatively coupled tothe processor 200.

To allow an operator and/or engineer to interact with the exampleprocessor 200, the example operator station 104 of FIG. 2 includes anytype of display 212. Example displays 212 include, but are not limitedto, a computer monitor, a computer screen, a television, a mobile device(e.g., a smart phone, a Blackberry™ and/or an iPhone™), etc. capable todisplay user interfaces and/or applications implemented by the processor200 and/or, more generally, the example operator station 104.

The example operating system 204 of FIG. 2 displays and/or facilitatesthe display of a user interface for the digital control application 206by and/or at the example display 212. The digital control application206 may configure and execute the operations or processes of the controlmodule(s) 208. Control modules typically contain control routines thatmay be instantiated and executed to perform control functions oractivities associated with respective process control system areas,devices, etc. More specifically, the control module(s) 208 may beassociated with one or more pieces of equipment, devices, and/or otherelements in a control system and, thus, may be used to monitor and/orcontrol those pieces equipment, devices and/or elements.

The example control module(s) 208 are made up of communicativelyinterconnected function block(s) 210, which are objects in anobject-oriented programming protocol that perform functions within thecontrol scheme based on inputs and provide outputs to other functionblocks within the control scheme. The control module(s) 208 may bededicated to a controller (e.g., the controller 102 of FIG. 1) and, insome cases, a field device (e.g., any of the field devices 110, 112,114, 120, 122 of FIG. 1) may store and execute a control module 208 or aportion thereof.

The function blocks 210 may each contain one or more mathematicalfunctions (e.g., summation operations, multiplication operations,division operations, etc.), logical functions, expressions (e.g.,logical OR, AND, etc.), control functions, interfaces, tuning functions,or any other desired functions within a process control system.

The function blocks 210 are composed of software and/or any other typeof logic to process input parameters according to a specified algorithmand an internal set of control parameters. In this manner, each of thefunction blocks 210 may produce output parameters that are available foruse by the control module 208, other function blocks, or any othersoftware, programmable device, etc. communicatively coupled to thefunction blocks 210. The parameters associated with the function blocks210 may pertain to the entire application process (e.g., manufacturingID, device type, etc.), encapsulate control functions (e.g., PIDcontroller, analog input, etc.), and/or may represent an interface tosensors such as temperature sensors, pressure sensors, flow sensors,etc.

During runtime, after the function blocks 210 are executed using thecorresponding input values, its outputs (i.e., output values) areupdated and then broadcast to other function blocks 210 and/or any otherdevice of the process control system that reads (e.g., subscribes orbinds to) these outputs. The function blocks 210 may reside inside thesame field device and/or in different devices of the process controlsystem.

While an example manner of implementing the example operator station 104of FIG. 1 has been illustrated in FIG. 2, the data structures, elements,processes and devices illustrated in FIG. 2 may be combined, divided,re-arranged, omitted, eliminated and/or implemented in any other way.Further, the example operating system 204, the example digital controlapplication 206, the example control module(s) 208, the example functionblock(s) 210, and/or, more generally, the example operator station 104of FIG. 2 may be implemented by hardware, software, firmware and/or anycombination of hardware, software and/or firmware. Further still, theexample operator station 104 may include additional elements, processesand/or devices instead of, or in addition to, those illustrated in FIG.2, and/or may include more than one of any or all of the illustrateddata structures, elements, processes and devices.

FIG. 3 illustrates a schematic layout of a known control module 300 offunction blocks 302 configured to apply multiple trip limits to a singleparameter of a process control system device. As shown, each of thefunction blocks 302 is identified by a unique tag 304 that may beassigned by a configuration engineer. Additionally, the parameters ofeach function block 302 are represented by object descriptions orparameter names 306 that define how the parameters are communicatedthroughout the process control system. Thus, many parameters in a systemmay be uniquely identified by reference to their tag (i.e., the tag 304of the function block 302 associated with the parameter) and parametername 306.

A first trip limit 308 (labeled as NORMAL_TRIP_LIM in FIG. 3) for anormal operational state is defined by a parameter input via block 310.A trip multiply factor 312 (labeled as TRIP_MULT_FACTOR in FIG. 3) isprovided via block 314 to calculate a second trip limit by multiplyingthe first trip limit 308 and the trip multiply factor 312 as describedin greater detail below. An analog input (AI) function block 316measures and/or receives the value of a parameter associated with thedevice to be monitored and produces a corresponding device parameter318. The value of the device parameter 318 output from the AI functionblock 316 is received as an input parameter 320 by an analog voter(AVTR) function block 322. The AVTR function block 322 compares thevalue of the device parameter 318 as input parameter 320 to a value ofan input trip limit 324 of the AVTR function block 322. When the valueof the device parameter 318 passes the value of the input trip limit324, the AVTR function block 322 sets a trip output 326 to a trippedvalue indicating a response to the state of the device being monitoredis to be implemented. However, as long as the input parameter 320 doesnot pass the input trip limit 324, the AVTR function block 322 does notprovide the trip output 326 indicating the limit has been tripped. Asused herein, a parameter value passes the relevant trip limit when theparameter either exceeds or drops below the trip limit depending uponwhether the trip limit is defined as a high or a low limit,respectively.

The input trip limit 324 may correspond to either the first trip limit308 defined via block 310 or a second trip limit defined by a valueequal to the first trip limit 308 multiplied by the trip multiply factor312 input via the block 314. Determining which value is to serve as theinput trip limit 324 of the AVTR function block 322, as well asperforming the multiplication calculation for the second trip limit, isaccomplished by a calculation (CALC) function block 328. The CALCfunction block 328 may receive a first input parameter 330 via an output332 of a discrete input (DI) function block 334 that indicates when akey switch associated with the DI function block 338 has been engaged toindicate whether the device is in an abnormal operational state. TheCALC function block 328 may receive the multiply factor 312 and thefirst trip limit 308 as second and third input parameters 336 and 338,respectively. Based on the algorithm performed by the CALC functionblock 328, as discussed below in FIG. 4, a calculated trip limit 340 isdetermined and serves as the input trip limit 324 to the AVTR functionblock 322.

FIG. 4 illustrates a known function block configuration interface 400 toconfigure the known CALC function block 328 shown in FIG. 3. In general,the CALC function block 328 has no inherent logic preconfigured withinit to use the inputs 330, 336, and 338 to determine the calculated triplimit 340 as the output of the CALC function block 328. Rather, theconfiguration interface 400 allows an operator and/or engineer to definewhat the calculated trip limit 340 of the CALC function block 328 shouldbe based on the inputs 330, 336, and 338 being processed in accordancewith a coded logic expression 402 written by the operator and/orengineer. In FIG. 4, the coded expression 402 involves determiningwhether the key switch is engaged by testing whether the first inputparameter 330 has a value of true. Depending upon the value of the firstinput parameter 330 (i.e., true or not), the coded expression 402 thendefines a calculated output value 340 that either equals the third inputparameter 338 (corresponding to the first trip limit 308) or the productof the third input parameter 338 and the second input parameter 336(corresponding to the trip multiply factor 305) to arrive at a secondtrip limit. In this way, the appropriate calculated trip limit 340 maybe determined and set as the input trip limit 324 of the AVTR functionblock 322 shown in FIG. 3.

FIG. 5 illustrates an example schematic layout of a control module 500configured to apply multiple trip limits to a single parameter of aprocess control system device. The control module 500 includes anexample AVTR function block 502 that receives inputs from the AIfunction block 316 shown in FIG. 3 and the DI function block 334 shownin FIG. 3. As described above in connection with FIG. 3, the AI functionblock 316 measures and/or receives the value of the parameter associatedwith the device to be monitored and produces the device parameter 318.The device parameter 318 serves as a first input parameter 504 to theexample AVTR function block 502. Further, the DI function block 334produces the output 332 corresponding to whether the key switchassociated with the DI function block 334 is engaged to indicate whetherthe device is in an abnormal operational state. The output 332 isreceived by the example AVTR function block 502 to serve as an abnormaltrip starter input 506 to indicate to the AVTR function block 502 whento apply a second trip limit associated with an abnormal operationalstate of the device and when to apply a first trip limit associated witha normal operational state of the device.

In this manner, by determining what trip limit should apply and when,the example control module 500 applies multiple trip limits whileavoiding the problems associated with the known control module 300 ofFIG. 3. In particular, the example control module 500 does not requireany coding or back calculations by an operator and/or engineer toconfigure the first and second trip limits and determine when either isto be applied. Rather, the logic and calculations are performedinternally within the AVTR function block 502 based on the inputs 504and 506, and trip limits directly entered by the operator and/orengineer in a configuration interface associated with the AVTR functionblock 502 discussed below in connection with FIG. 6. From thisconfiguration, the AVTR function block 502 may produce a trip output 508indicating whether the relevant trip limit has been passed.

FIG. 6 illustrates an example function block configuration interface 600to configure the AVTR function block 502 shown in FIG. 5. The exampleconfiguration interface 600 may include entry fields 602 to collectparameters defining a first trip limit 604 to be applied when a deviceis in a first operational state (i.e., a normal trip limit), a secondtrip limit 606 to be applied when the device is in a second operationalstate (i.e., an abnormal trip limit), and/or a time limit 608 associatedwith the second trip limit. Specifically, the example configurationinterface 600 may collect the value and units of the first and secondtrip limits 604 and 606 as well as the direction of the first and secondtrip limits 604 and 606 (i.e., a low limit or a high limit) and/or otherinformation via the entry fields 602, which may include entry fields,drop down menus, slider bars, check boxes, etc. Additionally, theinterface 600 may also include a means to select (e.g., via check boxes610) whether one or multiple input parameters are to be compared againstthe active trip limit in determining whether the trip output 508 is tobe set to a tripped value. Furthermore, there may be other configurationparameters (not shown) that enable operators and/or engineers to furtherdefine how the AVTR function block 502 functions.

As mentioned above, by specifying the trip limit parameters via theentry fields 602, the problems of known AVTR function blocks areavoided. In particular, separate entry fields 602 for each of the normaltrip limit 604 and the abnormal trip limit 606 enables an operatorand/or engineer to adjust one of the parameters and keep the otherconstant without having to back calculate or adjust the other. Further,no coding is required to determine which trip limit 604 or 606 to applybecause the determination is done internally by the AVTR function block502 based on the defined parameters 604, 606, and 608 and the inputs 504and 506. Similarly, if one of the trip limit parameters is changed,whether intentionally or not, such a change does not affect the othertrip limit parameter. As an additional advantage, the separate entryfields 602 enable an operator and/or engineer to see and/or compare thetwo trip limits directly.

Additionally, the ability to specify a time limit 608 sets a limit onhow long the second trip limit 606 corresponding to an abnormaloperational state may be active, thereby preventing the second triplimit 606 from remaining active even if the key switch has malfunctioned(e.g., if the key switch becomes stuck in the enabled position) and/orthe operational state of the device remains in the abnormal operationalstate for a longer duration than expected and/or desired (e.g., failingto reach a normal operational state during a start-up within a desiredamount of time). Furthermore, with the example control module 500implementing the example AVTR function block 502, an operator does notneed to hold a key switch for the entire duration the abnormaloperational state of the device to indicate that the second trip limitis to apply. Rather, engaging the key switch causes the AVTR functionblock 502 to apply the abnormal trip limit. At the same time, a timer isstarted to count down until the time limit 608 has elapsed, at whichpoint the AVTR function block 502 automatically returns to the firsttrip limit regardless of the actual operational state of the device. Inthis way, operators may focus their attention on other tasks rather thanholding the key switch during the entire period of an abnormaloperational state and tracking how long they have done so.

FIG. 7 is a flowchart representative of an example process that may becarried out to implement the example operator station of FIGS. 1 and/or2. More particularly, the example process of FIG. 7 may be implementedusing machine readable instructions that comprise a program forexecution by a processor such as the processor 812 shown in the examplecomputer 800 discussed below in connection with FIG. 8. The program maybe embodied in software stored on a tangible computer readable mediumsuch as a CD-ROM, a floppy disk, a hard drive, a digital versatile disk(DVD), a BluRay disk, or a memory associated with the processor 812.Alternatively, some or all of the example process of FIG. 7 may beimplemented using any combination(s) of application specific integratedcircuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), fieldprogrammable logic device(s) (FPLD(s)), discrete logic, hardware,firmware, etc. Also, some or all of the example process of FIG. 7 may beimplemented manually or as any combination(s) of any of the foregoingtechniques, for example, any combination of firmware, software, discretelogic and/or hardware. Further, although the example process isdescribed with reference to the flowchart illustrated in FIG. 7, manyother methods of implementing the example operator station of FIGS. 1and/or 2 may alternatively be used. For example, the order of executionof the blocks may be changed, and/or some of the blocks described may bechanged, eliminated, or combined. Additionally, any or all of theexample process of FIG. 7 may be performed sequentially and/or inparallel by, for example, separate processing threads, processors,devices, discrete logic, circuits, etc.

As mentioned above, the example process of FIG. 7 may be implementedusing coded instructions (e.g., computer readable instructions) storedon a tangible computer readable medium such as a hard disk drive, aflash memory, a read-only memory (ROM), a compact disk (CD), a digitalversatile disk (DVD), a cache, a random-access memory (RAM) and/or anyother storage media in which information is stored for any duration(e.g., for extended time periods, permanently, brief instances, fortemporarily buffering, and/or for caching of the information). As usedherein, the term tangible computer readable medium is expressly definedto include any type of computer readable storage and to excludepropagating signals. Additionally or alternatively, the example processof FIG. 7 may be implemented using coded instructions (e.g., computerreadable instructions) stored on a non-transitory computer readablemedium such as a hard disk drive, a flash memory, a read-only memory, acompact disk, a digital versatile disk, a cache, a random-access memoryand/or any other storage media in which information is stored for anyduration (e.g., for extended time periods, permanently, brief instances,for temporarily buffering, and/or for caching of the information). Asused herein, the term non-transitory computer readable medium isexpressly defined to include any type of computer readable medium and toexclude propagating signals. As used herein, when the phrase “at least”is used as the transition term in a preamble of a claim, it isopen-ended in the same manner as the term “comprising” is open ended.Thus, a claim using “at least” as the transition term in its preamblemay include elements in addition to those expressly recited in theclaim.

The example process of FIG. 7 begins at block 700 where the AVTRfunction block 502 (FIG. 5) receives a first trip limit 604 (FIG. 6)associated with a first operational state (e.g., a normal operationalstate) of a device that may be stored in a memory 202 (FIG. 2). In theillustrated examples, the first trip limit 604 is received by parametersentered as inputs in the example entry fields 602 of the examplefunction block configuration interface 600 (FIG. 6). The AVTR functionblock 502 also receives the second trip limit 606 (FIG. 6) associatedwith a second operational state (e.g., an abnormal operational state) ofthe device (block 702) that may be stored in the memory 202. The secondtrip limit 606 is received by parameters entered as inputs in otherentry fields 602 of the example function block configuration interface600. The AVTR function block 502 may also receive the time limit 608(FIG. 6) corresponding to the allowable and/or desired maximum durationof monitoring the device in the second operational state (block 704) viaanother entry field 602 of the example function block configurationinterface 600 and stored in the memory 202. For example, operatorsand/or engineers may set the allowable and/or desirable duration for thesecond operational state based on the normal and/or expected duration ofthe device to remain in the second operational state (e.g., the typicaltime period for a machine to start up). Additionally and/oralternatively, operators and/or engineers may set the allowable and/ordesirable duration for monitoring the device in the second operationalstate based on the time before the operational condition of the devicewould be deemed unsafe or otherwise undesirable to continue in thesecond operational state. Operators and/or engineers setting the timelimit 608 corresponding to the allowable and/or desirable duration ofmonitoring the device in the second operational state does notnecessarily prevent the device from remaining in the second operationalstate. Rather, the time limit 608 prevents the continued monitoring ofthe device against the second trip limit corresponding to the secondoperational state by reverting to the first trip limit as will bedescribed more fully below.

In the example process of FIG. 7, the digital control application 206(FIG. 2) may monitor a parameter (e.g., the device parameter 318 of FIG.5) associated with the operation of the device (block 706). For example,the digital control application 206 of FIG. 2 may instantiate a controlmodule 208 containing function blocks 210 arranged according to theexample control module 500 of FIG. 5. The AI function block 316 (FIG. 5)may be associated with the device to output the device parameter 318,which serves as the input parameter 504 of the AVTR function block 502.The AVTR function block 502 monitors the device parameter 318 againstthe trip limits 604 and 606 described above.

At block 708 the AVTR function block 502 determines whether the keyswitch is engaged. Such a determination is made via the DI functionblock 334, which produces the output 332 to serve as the abnormal tripstarter input 506 of the AVTR function block 502. As described above,operators engage the key switch to indicate the device is in the secondoperational state, thereby indicating the second trip limit is to applywhen monitoring the device parameter 318. However, whether the keyswitch is engaged is not solely determinative of whether the second triplimit 606 applies because the AVTR function block 502 is configured tolimit the application of the second trip limit 606 to the durationcorresponding to the time limit 608. Accordingly, if the AVTR functionblock 502 determines that the key switch is engaged, the AVTR functionblock 502 then determines whether a timer is already running (block710). If no timer is running, the example process starts the timer atblock 712 and control then advances to block 714 where the AVTR functionblock 502 determines whether the device parameter 318 has passed thesecond trip limit 604. The AVTR function block 502 makes such adetermination by comparing the device parameter 318 as the parameterinput 504 to the previously defined second trip limit 606. If the deviceparameter 318 has not passed the second trip limit 606, control returnsto block 706 to continue monitoring the device parameter 318. However,if the example process of FIG. 7 determines that the device parameter318 has passed the second trip limit 606 (block 714), the digitalcontrol application 206 may implement a response (block 716). Forexample, after the device parameter 318 passes the second trip limit606, the output of the AVTR function block 502 indicates the limit hasbeen tripped, which may activate a warning alarm. However, any otherappropriate response may also be implemented at block 716 (e.g.,shutting down the device).

If the AVTR function block 502 determines at block 710 that the timer isalready running (i.e., the key switch was previously engaged and thetimer was previously started), the AVTR function block 502 determineswhether the timer has exceeded the time limit 608 (block 718). If not,the duration of the operational state of the device is still within theallowable and/or desired time limit 608 such that the second trip limit606 is still applicable. Therefore, the example process returns controlto block 714 to determine whether the device parameter 318 has passedthe second trip limit 606 and the example process proceeds accordingly.If the timer has exceeded the time limit 608 then the device parameter318 is to be monitored relative to the first trip limit 604 regardlessof the operational state of the device (i.e., whether it is in a normalor abnormal operational state). Accordingly, when the AVTR functionblock 502 determines the timer has exceeded the time limit 608, thetimer is reset (block 720) and control advances to block 722 where theexample process of FIG. 7 determines whether the device parameter 318has passed the first trip limit 604. Whether the device parameter 318has passed the first trip limit 604 is determined in the same way as forthe second trip limit 608 described above in connection with block 714except that the comparison is made with the first trip limit 604. If thedevice parameter 318 has passed the first trip limit 604, the exampleprocess advances to block 716 where the digital control application 206may implement an appropriate response. If the device parameter 318 hasnot passed the first trip limit 604, control of the example processreturns to block 706 to continue monitoring the device parameter 318.

Returning to block 708, if the AVTR function block 502 determines thatthe key switch is not engaged, the example process advances to block 724where the AVTR function block 502 determines whether the timer isalready running. If the timer is already running (i.e., the key switchwas previously engaged and the timer was previously started), the AVTRfunction block 502 determines whether the timer has exceeded the timelimit 608 as described above in connection with block 718 and theexample process proceeds accordingly. Thus, in this manner, operators donot need to hold the key switch for the entire duration of the secondoperational state to nevertheless have the second trip limit 608 applyto the device parameter 318 so long as the timer has not exceeded thetime limit 608. Where the key switch is not engaged (determined at block708) and the timer is not already running (determined at block 724), theexample process advances directly to block 722 to determine whether thedevice parameter 318 has passed the first trip limit 604 as describedabove.

As shown in the example flowchart of FIG. 7, the response implementedafter the device parameter 318 passes the first trip limit 604(determined at block 722) is represented by the same block (block 716)as the response implemented when the device parameter 318 passes thesecond trip limit 606 (determined at block 714). However, in someexamples, the response implemented when the first trip limit 604 ispassed may be configured to be different than the response implementedwhen the second trip limit 606 is passed by the device parameter 318.For example, while the first limit 604 being tripped may activate analarm, the second trip limit 606 may force the device into a safe state(e.g., shut down the device).

FIG. 8 is a schematic illustration of an example computer 800 that maybe used and/or programmed to carry out the example process of FIG. 7and/or, more generally, to implement the example operator station 104 ofFIGS. 1 and/or 2. The system 800 of the instant example includes aprocessor 812. For example, the processor 812 can be implemented by oneor more microprocessors or controllers from any desired family ormanufacturer.

The processor 812 includes a local memory 813 (e.g., a cache) and is incommunication with a main memory including a volatile memory 814 and anon-volatile memory 816 via a bus 818. The volatile memory 814 may beimplemented by Synchronous Dynamic Random Access Memory (SDRAM), DynamicRandom Access Memory (DRAM), RAMBUS Dynamic Random Access Memory (RDRAM)and/or any other type of random access memory device. The non-volatilememory 816 may be implemented by flash memory and/or any other desiredtype of memory device. Access to the main memory 814 and 816 iscontrolled by a memory controller.

The computer 800 also includes an interface circuit 820. The interfacecircuit 820 may be implemented by any type of interface standard, suchas an Ethernet interface, a universal serial bus (USB), and/or a PCIexpress interface. One or more input devices 822 are connected to theinterface circuit 820. The input device(s) 822 permit a user to enterdata and commands into the processor 812. The input device(s) can beimplemented by, for example, a keyboard, a mouse, a touchscreen, atrack-pad, a trackball, isopoint and/or a voice recognition system. Oneor more output devices 824 are also connected to the interface circuit820. The output devices 824 can be implemented, for example, by displaydevices (e.g., a liquid crystal display, a cathode ray tube display(CRT), a printer and/or speakers). The interface circuit 820, thus,typically includes a graphics driver card.

The interface circuit 820 also includes a communication device such as amodem or network interface card to facilitate exchange of data withexternal computers via a network 826 (e.g., an Ethernet connection, adigital subscriber line (DSL), a telephone line, coaxial cable, acellular telephone system, etc.).

The computer 800 also includes one or more mass storage devices 828 forstoring software and data. Examples of such mass storage devices 828include floppy disk drives, hard drive disks, compact disk drives anddigital versatile disk (DVD) drives.

The coded instructions 832 to implement the example process of FIG. 7may be stored in the mass storage device 828, in the volatile memory814, in the non-volatile memory 816, and/or on a removable storagemedium such as a CD or DVD.

Although certain example methods, apparatus and articles of manufacturehave been described herein, the scope of coverage of this patent is notlimited thereto. Such examples are intended to be non-limitingillustrative examples. On the contrary, this patent covers all methods,apparatus and articles of manufacture fairly falling within the scope ofthe appended claims either literally or under the doctrine ofequivalents.

What is claimed is:
 1. A method to apply multiple trip limits to adevice in a process control system comprising: monitoring a value of aparameter associated with operation of the device; receiving via afunction block an input that is either a first input or a second input,the first input indicating the device is in a first operational stateand the second input indicating the device is in a second operationalstate; when the first input is received at a first time period: (a)comparing via the function block the value of the parameter to a firsttrip limit; and (b) implementing a response based on the comparison ofthe value of the parameter to the first trip limit; when the secondinput is received at a second time period: (a) comparing via thefunction block the value of the parameter to a second trip limit; and(b) implementing the response based on the comparison of the value ofthe parameter to the second trip limit; and wherein the value of theparameter is compared to the first trip limit and not the second triplimit at the first time period associated with the first input, andwherein the value of the parameter is compared to the second trip limitand not the first trip limit at the second time period associated withthe second input, wherein the first trip limit and the second trip limitare independently input into the function block by at least one of anoperator or an engineer.
 2. A method as described in claim 1, whereinthe response comprises at least one of sending an alarm to an operator,tripping the device into a third operational state different than thefirst and second operational states, or shutting down the device.
 3. Amethod as described in claim 2, wherein the value of the parameter inthe third operational state is within the first trip limit and withinthe second trip limit.
 4. A method as described in claim 1, furthercomprising: when the input changes to the second input, activating atimer to run a duration of a time limit; and after the time limit haselapsed, comparing via the function block the value of the parameter tothe first trip limit regardless of the input.
 5. A method as describedin claim 4, wherein the time limit is independently input into thefunction block by at least one of an operator or an engineerindependently of the first trip limit and the second trip limit.
 6. Amethod as described in claim 1, wherein the first operational state ofthe device corresponds to a normal operational state of the device, andwherein the second operational state of the device corresponds to anabnormal operational state of the device.
 7. A method as described inclaim 1, wherein the first trip limit corresponds to a low limit for theparameter and the second trip limit corresponds to a high limit for theparameter.
 8. A method as described in claim 1, wherein the first triplimit corresponds to a first low limit for the parameter and the secondtrip limit corresponds to a second low limit for the parameter lowerthan the first low limit, or the first trip limit corresponds to a firsthigh limit for the parameter and the second trip limit corresponds to asecond high limit for the parameter higher than the first high limit. 9.A method as described in claim 1, wherein the input is received via atleast one of a key switch or a push button.
 10. A processor which, whenoperated, implements a function block to: receive an input indicating aprocess control system device is in either a first operational state ora second operational state; receive first and second trip limits for aparameter associated with the operation of the device, wherein the firstand second trip limits are associated with the respective first andsecond operational states of the device; when the input indicates theprocess control system device is in the first operational state at afirst time period: (a) enable the first trip limit to compare with avalue of the parameter and disable the second trip limit; and (b)implement a first response when a value of the parameter passes thefirst trip limit; and when the input indicates the process controlsystem device is in the second operational state at a second timeperiod: (a) enable the second trip limit to compare with the value ofthe parameter and disable the first trip limit; and (b) implement asecond response when the value of the parameter passes the second triplimit; and wherein the value of the parameter is compared to the firsttrip limit and not the second trip limit at the first time periodassociated with the first operational state, and wherein the value ofthe parameter is compared to the second trip limit and not the firsttrip limit at the second time period associated with the secondoperational state, wherein the first trip limit and the second triplimit are independently input into the function block by at least one ofan operator or an engineer.
 11. A processor as described in claim 10,wherein at least one of first or second operational states correspondsto an unsafe condition.
 12. A processor as described in claim 10,wherein the first and second responses comprise at least one of sendingan alarm to an operator, tripping the device into a third operationalstate different than the first and second operational states, orshutting down the device.
 13. A processor as described in claim 12,wherein a value of the parameter in the third operational state iswithin the first trip limit and within the second trip limit.
 14. Aprocessor as described in claim 10 which, when operated, implements thefunction block to further: activate a timer when the second trip limitis first enabled to run a duration of a time limit; and after the timelimit has elapsed, implementing the first response when the parameterpasses the first trip limit regardless of which trip limit is enabled.15. A processor as described in claim 10, wherein the first operationalstate of the device corresponds to a normal operational state of thedevice, and wherein the second operational state of the devicecorresponds to an operational state other than the normal operationalstate.
 16. A processor as described in claim 10, wherein the first triplimit corresponds to a high limit for the parameter and the second triplimit corresponds to a low limit for the parameter.
 17. A processor asdescribed in claim 10, wherein the first trip limit corresponds to afirst low limit for the parameter and the second trip limit correspondsto a second low limit for the parameter lower than the first low limit,or the first trip limit corresponds to a first high limit for theparameter and the second trip limit corresponds to a second high limitfor the parameter higher than the first high limit.
 18. A processor asdescribed in claim 10, wherein the input is received via at least one ofa key switch or a push button.
 19. A tangible article of manufacturestoring machine readable instructions which, when executed, cause amachine to at least: monitor a value of a parameter associated withoperation of a process control system device; receive an input that iseither a first input or a second input, the first input indicating thedevice is in a first operational state and the second input indicatingthe device is in a second operational state; when the first input isreceived at a first time period: (a) compare the value of the parameterto a first trip limit; and (b) implement a first response based on thecomparison of the value of the parameter to the first trip limit; andwhen the second input is received at a second time period: (a) comparethe value of the parameter to a second trip limit; and (b) implement asecond response based on the comparison of the value of the parameter tothe second trip limit; and wherein the value of the parameter iscompared to the first trip limit and not the second trip limit at thefirst time period associated with the first input, and wherein the valueof the parameter is compared to the second trip limit and not the firsttrip limit at the second time period associated with the second input,wherein the first trip limit and the second trip limit are independentlyinput into the function block by at least one of an operator or anengineer.
 20. A tangible article of manufacture as described in claim19, wherein the first and second responses comprise at least one ofsending an alarm to an operator, tripping the device into a thirdoperational state different than the first and second operationalstates, or shutting down the device.
 21. A tangible article ofmanufacture as described in claim 19, wherein the instructions, whenexecuted, further cause the machine to: when the input changes to thesecond trip limit, activate a timer to run a duration of a time limit;and after the time limit has elapsed, compare the value of the parameterto the first trip limit regardless of the input.
 22. A tangible articleof manufacture as described in claim 19, wherein the first operationalstate of the device corresponds to a normal operational state of thedevice, and wherein the second operational state of the devicecorresponds to an abnormal operational state of the device.
 23. Atangible article of manufacture as described in claim 19, wherein theinput is received via at least one of a key switch or a push button.